[PATCH net] ptp: ocp: prevent watchdog rearming during detach

[PATCH net] ptp: ocp: prevent watchdog rearming during detach

[Runyu Xiao]

ptp_ocp_detach() uses timer_delete_sync() to stop the watchdog before
freeing the ptp_ocp state. timer_delete_sync() waits for a callback that is
already running but does not prevent the callback from rearming the timer.

Since ptp_ocp_watchdog() unconditionally calls mod_timer(), detach can
return with the watchdog pending. A later callback can access freed state.

Use timer_shutdown_sync() for the final watchdog teardown. This ensures the
callback is complete and cannot rearm the timer before the state is freed.

Fixes: 773bda964921 ("ptp: ocp: Expose various resources on the timecard.")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/ptp/ptp_ocp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c
index 3d26ec1f7..6b5f615a2 100644
--- a/drivers/ptp/ptp_ocp.c
+++ b/drivers/ptp/ptp_ocp.c
@@ -4870,7 +4870,7 @@ ptp_ocp_detach(struct ptp_ocp *bp)
 	ptp_ocp_debugfs_remove_device(bp);
 	ptp_ocp_detach_sysfs(bp);
 	ptp_ocp_attr_group_del(bp);
-	timer_delete_sync(&bp->watchdog);
+	timer_shutdown_sync(&bp->watchdog);
 	/* Disable interrupts on all timestampers */
 	if (bp->ts0)
 		ptp_ocp_ts_enable(bp->ts0, 0, false);
-- 
2.34.1

Re: [PATCH net] ptp: ocp: prevent watchdog rearming during detach

[Vadim Fedorenko]

On 04/09/2026 07:43, Runyu Xiao wrote:
> ptp_ocp_detach() uses timer_delete_sync() to stop the watchdog before
> freeing the ptp_ocp state. timer_delete_sync() waits for a callback that is
> already running but does not prevent the callback from rearming the timer.
> 
> Since ptp_ocp_watchdog() unconditionally calls mod_timer(), detach can
> return with the watchdog pending. A later callback can access freed state.
> 
> Use timer_shutdown_sync() for the final watchdog teardown. This ensures the
> callback is complete and cannot rearm the timer before the state is freed.
> 
> Fixes: 773bda964921 ("ptp: ocp: Expose various resources on the timecard.")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:GPT-5
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> ---
>   drivers/ptp/ptp_ocp.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c
> index 3d26ec1f7..6b5f615a2 100644
> --- a/drivers/ptp/ptp_ocp.c
> +++ b/drivers/ptp/ptp_ocp.c
> @@ -4870,7 +4870,7 @@ ptp_ocp_detach(struct ptp_ocp *bp)
>   	ptp_ocp_debugfs_remove_device(bp);
>   	ptp_ocp_detach_sysfs(bp);
>   	ptp_ocp_attr_group_del(bp);
> -	timer_delete_sync(&bp->watchdog);
> +	timer_shutdown_sync(&bp->watchdog);
>   	/* Disable interrupts on all timestampers */
>   	if (bp->ts0)
>   		ptp_ocp_ts_enable(bp->ts0, 0, false);

Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>